Doug / smarc-fsl-linux-kernel

28 Mar, 2009

1 commit

  • 389fb800a   netlabel: Label incoming TCP connections correctly in SELinux ... Browse Code »

    The current NetLabel/SELinux behavior for incoming TCP connections works but
    only through a series of happy coincidences that rely on the limited nature of
    standard CIPSO (only able to convey MLS attributes) and the write equality
    imposed by the SELinux MLS constraints. The problem is that network sockets
    created as the result of an incoming TCP connection were not on-the-wire
    labeled based on the security attributes of the parent socket but rather based
    on the wire label of the remote peer. The issue had to do with how IP options
    were managed as part of the network stack and where the LSM hooks were in
    relation to the code which set the IP options on these newly created child
    sockets. While NetLabel/SELinux did correctly set the socket's on-the-wire
    label it was promptly cleared by the network stack and reset based on the IP
    options of the remote peer.

    This patch, in conjunction with a prior patch that adjusted the LSM hook
    locations, works to set the correct on-the-wire label format for new incoming
    connections through the security_inet_conn_request() hook. Besides the
    correct behavior there are many advantages to this change, the most significant
    is that all of the NetLabel socket labeling code in SELinux now lives in hooks
    which can return error codes to the core stack which allows us to finally get
    ride of the selinux_netlbl_inode_permission() logic which greatly simplfies
    the NetLabel/SELinux glue code. In the process of developing this patch I
    also ran into a small handful of AF_INET6 cleanliness issues that have been
    fixed which should make the code safer and easier to extend in the future.

    Signed-off-by: Paul Moore
    Acked-by: Casey Schaufler
    Signed-off-by: James Morris

    Paul Moore
     

01 Jan, 2009

1 commit

10 Oct, 2008

4 commits

  • 15c45f7b2   cipso: Add support for native local labeling and fixup mapping names ... Browse Code »

    This patch accomplishes three minor tasks: add a new tag type for local
    labeling, rename the CIPSO_V4_MAP_STD define to CIPSO_V4_MAP_TRANS and
    replace some of the CIPSO "magic numbers" with constants from the header
    file. The first change allows CIPSO to support full LSM labels/contexts,
    not just MLS attributes. The second change brings the mapping names inline
    with what userspace is using, compatibility is preserved since we don't
    actually change the value. The last change is to aid readability and help
    prevent mistakes.

    Signed-off-by: Paul Moore

    Paul Moore
     
  • 014ab19a6   selinux: Set socket NetLabel based on connection endpoint ... Browse Code »

    Previous work enabled the use of address based NetLabel selectors, which while
    highly useful, brought the potential for additional per-packet overhead when
    used. This patch attempts to solve that by applying NetLabel socket labels
    when sockets are connect()'d. This should alleviate the per-packet NetLabel
    labeling for all connected sockets (yes, it even works for connected DGRAM
    sockets).

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     
  • 948bf85c1   netlabel: Add functionality to set the security attributes of a packet ... Browse Code »

    This patch builds upon the new NetLabel address selector functionality by
    providing the NetLabel KAPI and CIPSO engine support needed to enable the
    new packet-based labeling. The only new addition to the NetLabel KAPI at
    this point is shown below:

    * int netlbl_skbuff_setattr(skb, family, secattr)

    ... and is designed to be called from a Netfilter hook after the packet's
    IP header has been populated such as in the FORWARD or LOCAL_OUT hooks.

    This patch also provides the necessary SELinux hooks to support this new
    functionality. Smack support is not currently included due to uncertainty
    regarding the permissions needed to expand the Smack network access controls.

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     
  • b1edeb102   netlabel: Replace protocol/NetLabel linking with refrerence counts ... Browse Code »

    NetLabel has always had a list of backpointers in the CIPSO DOI definition
    structure which pointed to the NetLabel LSM domain mapping structures which
    referenced the CIPSO DOI struct. The rationale for this was that when an
    administrator removed a CIPSO DOI from the system all of the associated
    NetLabel LSM domain mappings should be removed as well; a list of
    backpointers made this a simple operation.

    Unfortunately, while the backpointers did make the removal easier they were
    a bit of a mess from an implementation point of view which was making
    further development difficult. Since the removal of a CIPSO DOI is a
    realtively rare event it seems to make sense to remove this backpointer
    list as the optimization was hurting us more then it was helping. However,
    we still need to be able to track when a CIPSO DOI definition is being used
    so replace the backpointer list with a reference count. In order to
    preserve the current functionality of removing the associated LSM domain
    mappings when a CIPSO DOI is removed we walk the LSM domain mapping table,
    removing the relevant entries.

    Signed-off-by: Paul Moore
    Reviewed-by: James Morris

    Paul Moore
     

09 Jun, 2007

1 commit

  • ba6ff9f2b   [NetLabel]: consolidate the struct socket/sock handling to just struct sock ... Browse Code »

    The current NetLabel code has some redundant APIs which allow both
    "struct socket" and "struct sock" types to be used; this may have made
    sense at some point but it is wasteful now. Remove the functions that
    operate on sockets and convert the callers. Not only does this make
    the code smaller and more consistent but it pushes the locking burden
    up to the caller which can be more intelligent about the locks. Also,
    perform the same conversion (socket to sock) on the SELinux/NetLabel
    glue code where it make sense.

    Signed-off-by: Paul Moore
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Paul Moore
     

26 Apr, 2007

1 commit

03 Dec, 2006

1 commit

30 Sep, 2006

1 commit

  • 95d4e6be2   [NetLabel]: audit fixups due to delayed feedback ... Browse Code »

    Fix some issues Steve Grubb had with the way NetLabel was using the audit
    subsystem. This should make NetLabel more consistent with other kernel
    generated audit messages specifying configuration changes.

    Signed-off-by: Paul Moore
    Acked-by: Steve Grubb
    Signed-off-by: David S. Miller

    Paul Moore
     

29 Sep, 2006

1 commit

  • 32f50cdee   [NetLabel]: add audit support for configuration changes ... Browse Code »

    This patch adds audit support to NetLabel, including six new audit message
    types shown below.

    #define AUDIT_MAC_UNLBL_ACCEPT 1406
    #define AUDIT_MAC_UNLBL_DENY 1407
    #define AUDIT_MAC_CIPSOV4_ADD 1408
    #define AUDIT_MAC_CIPSOV4_DEL 1409
    #define AUDIT_MAC_MAP_ADD 1410
    #define AUDIT_MAC_MAP_DEL 1411

    Signed-off-by: Paul Moore
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Paul Moore
     

26 Sep, 2006

2 commits

23 Sep, 2006

3 commits